958599aafad2245abf6a154b5c8c1b738e6633dfcbced531063825938db6f0da

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2023, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.97c443b0903470b440f78e39d32ed760.dll
Size

869KB
MD5

97c443b0903470b440f78e39d32ed760
SHA1

edd88969aa68089d29a4ab462f24ffab4f25ea82
SHA256

958599aafad2245abf6a154b5c8c1b738e6633dfcbced531063825938db6f0da
SHA512

8acbab25b20649ab7b2d53ea8ca8e618883f3c873b9f2334d71e464e061862b2ab1b9b1d0e06b5a0bd3e73466274a85031ef2f6080dc6d18a4a4cdd456c6df1c
SSDEEP

24576:b0az6cu3WVd/jBhc2Uhc2UF4C6Hmit8NZt8NZJY5Ag1dLwHRDRj:b0az6cbd/jBhc2Uhc2UF4C6Hmit8NZtk

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4988	3296	WerFault.exe	86

Modifies registry class 55 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30355649-0000-0010-8000-00AA00389B71}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4448-D905-11D0-A30E-444553540000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.97c443b0903470b440f78e39d32ed760.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4445-D905-11D0-A30E-444553540000}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1C0FE00-F3C2-11D0-91D4-444553540000}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2DE89781-DBF6-11D0-A30E-444553540000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.97c443b0903470b440f78e39d32ed760.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4444-D905-11D0-A30E-444553540000}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4448-D905-11D0-A30E-444553540000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2DE89781-DBF6-11D0-A30E-444553540000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30355649-0000-0010-8000-00AA00389B71}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4443-D905-11D0-A30E-444553540000}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4444-D905-11D0-A30E-444553540000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E369A160-F3C2-11D0-91D4-444553540000}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E369A160-F3C2-11D0-91D4-444553540000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.97c443b0903470b440f78e39d32ed760.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4448-D905-11D0-A30E-444553540000}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4443-D905-11D0-A30E-444553540000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4443-D905-11D0-A30E-444553540000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.97c443b0903470b440f78e39d32ed760.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4443-D905-11D0-A30E-444553540000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E369A160-F3C2-11D0-91D4-444553540000}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4445-D905-11D0-A30E-444553540000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.97c443b0903470b440f78e39d32ed760.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4445-D905-11D0-A30E-444553540000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A444A-D905-11D0-A30E-444553540000}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A444A-D905-11D0-A30E-444553540000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.97c443b0903470b440f78e39d32ed760.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A444A-D905-11D0-A30E-444553540000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2DE89781-DBF6-11D0-A30E-444553540000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4444-D905-11D0-A30E-444553540000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.97c443b0903470b440f78e39d32ed760.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4448-D905-11D0-A30E-444553540000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E369A160-F3C2-11D0-91D4-444553540000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1C0FE00-F3C2-11D0-91D4-444553540000}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1C0FE00-F3C2-11D0-91D4-444553540000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2DE89781-DBF6-11D0-A30E-444553540000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30355649-0000-0010-8000-00AA00389B71}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.97c443b0903470b440f78e39d32ed760.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1C0FE00-F3C2-11D0-91D4-444553540000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.97c443b0903470b440f78e39d32ed760.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2DE89781-DBF6-11D0-A30E-444553540000}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4443-D905-11D0-A30E-444553540000}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4445-D905-11D0-A30E-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1C0FE00-F3C2-11D0-91D4-444553540000}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30355649-0000-0010-8000-00AA00389B71}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.97c443b0903470b440f78e39d32ed760.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30355649-0000-0010-8000-00AA00389B71}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4445-D905-11D0-A30E-444553540000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4444-D905-11D0-A30E-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4448-D905-11D0-A30E-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A444A-D905-11D0-A30E-444553540000}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A444A-D905-11D0-A30E-444553540000}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{665A4444-D905-11D0-A30E-444553540000}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84725EA1-2FBC-11D1-BC86-00A0C969FC67}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.97c443b0903470b440f78e39d32ed760.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E369A160-F3C2-11D0-91D4-444553540000}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 3296	2728	regsvr32.exe	86
PID 2728 wrote to memory of 3296	2728	regsvr32.exe	86
PID 2728 wrote to memory of 3296	2728	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.97c443b0903470b440f78e39d32ed760.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.97c443b0903470b440f78e39d32ed760.dll
  2⤵
  - Modifies registry class
  PID:3296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 716
    3⤵
    - Program crash
    PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3296 -ip 3296
1⤵
PID:5048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3296-0-0x0000000070B30000-0x0000000070C15000-memory.dmp

Filesize
916KB

Download
memory/3296-1-0x0000000070B30000-0x0000000070C15000-memory.dmp

Filesize
916KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads